@hivemagnus/hive-common 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -6,6 +6,66 @@ All notable changes to `@hivemagnus/hive-common` are recorded here. The format f
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-11-12
+
+Native-issuer service tokens. Oathweave signs client-credentials tokens with its native issuer
+(its `JWT_ISSUER`, for example `hive-iam`), which is a name, not an https URL, so 0.2.0 refused the
+configuration and products kept a local jose check for those tokens. Every change is additive:
+without the new options a verifier behaves as in 0.2.0.
+
+### Added
+
+- `/oathweave`: `nativeIssuers` accepts tokens whose `iss` is one of the listed native
+  identifiers. Each must match `OATHWEAVE_NATIVE_ISSUER_PATTERN` (`^[a-z][a-z0-9-]{0,63}$`), so a
+  URL or anything else is a startup error. They are verified with the same `jwksUrl` (still https)
+  or `keys` as the https issuer, because Oathweave signs both with one key. A native issuer is never
+  accepted unless listed. `verifier.nativeIssuers` lists them.
+- `/oathweave`: `nativeIssuerAccept` (default `'service'`) limits which principals a native issuer
+  may sign for. A user token from a native issuer is refused with `invalid_issuer` by default,
+  before any userinfo call.
+- `/oathweave`: `maxLifetimeSec` also takes `{ user?, service? }`, one limit per principal kind;
+  each defaults to 900. `ClaimPolicy.maxLifetimeSec` and `principalFromClaims()` take the same
+  shape. The `OathweaveLifetimeLimits` type is exported.
+- `/oathweave/conformance`: `ConformanceVectors.nativeIssuers` and `ConformanceContext.nativeIssuers`.
+  `hiveCommonConformanceVerify()` configures them.
+- Conformance vectors: `valid-native-service` (accept), `unconfigured-native-issuer` (401
+  `invalid_issuer`) and `native-service-lifetime-too-long` (401 `invalid_lifetime`). There is no
+  vector for a native-issuer user token, because Oathweave does issue those (to registered clients
+  that are not suite browser clients); refusing them is a product setting, not a contract.
+- README: "Native issuers", and native-issuer and per-kind lifetime rows in "Choosing settings for
+  an existing product".
+
+### Changed
+
+- The conformance vectors were regenerated with `npm run vectors:generate` to sign the new tokens,
+  so every token and the test JWKS changed (the signing keys are discarded after each run). The
+  existing vectors keep their names, claims and expected outcomes. A product verifier that is not
+  configured with `ctx.nativeIssuers` now fails `valid-native-service`; configure it, or exclude
+  that vector with `only` until the product accepts native issuers.
+
+## [0.2.0] - 2026-11-12
+
+Options that let a product keep its existing behaviour without wrapping the shared helpers. Every
+change is additive: the defaults are those of 0.1.0.
+
+### Added
+
+- `/oathweave`: `requireRoles` (default `false`) refuses a token without a `roles` array.
+- `/oathweave`: `clientIdClaim: 'clientId' | 'client_id' | 'either'` (default `'either'`) chooses
+  which claim names supply the client ID. Both claims present must still agree. `clientIdOf()`,
+  `principalKindOf()` and `extractRoles()` take matching optional arguments, and `ClaimPolicy`
+  matching optional fields. `CLIENT_ID_CLAIMS` and the `ClientIdClaim` type are exported.
+- `/oathweave`: `parseIdentityLinks()` accepts `localId` as an alias of `localUserId`. An entry
+  that sets both to different values is refused. Parsed links always use `localUserId`.
+- `/context`: `trustInboundRequestId` and `trustInboundTrace` trust the inbound request ID and the
+  inbound `traceparent`/`tracestate` separately. Each defaults to `trustInbound`. The `/hono` and
+  `/node-http` adapters take them too.
+- `/health`: `liveBody` replaces the `/health/live` body with a product's own, as an object or a
+  function of the standard body. `liveness()`, `createHealth()`, `Health`, `registerHealthRoutes()`
+  and `hiveHandler({ health })` accept it; `HealthOptions` and `Health` take an optional type
+  parameter for the body, defaulting to `LiveBody`.
+- README: "Choosing settings for an existing product".
+
 ## [0.1.0] - 2026-11-12
 
 First release: the shared server kit that replaces each product's own copy of the Oathweave
@@ -37,5 +97,7 @@ verifier and its own error, health and request-ID conventions.
   pagination and agent identity.
 - `/hono` and `/node-http` adapters for auth, request context, the error envelope and health.
 
-[Unreleased]: https://github.com/ChefTaco/HiveCommon/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/ChefTaco/HiveCommon/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/ChefTaco/HiveCommon/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/ChefTaco/HiveCommon/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/ChefTaco/HiveCommon/releases/tag/v0.1.0

package/README.md

@@ -100,11 +100,13 @@ What it checks, in order: a compact JWT of at most 16 KiB; header `alg` is `RS25
 HMAC key confusion never reach a key); signature against the JWKS (cached for 10 minutes and
 refetched, at most every 30 s, when a token names an unknown `kid`); `iss` is one of the issuers;
 `aud` is exactly the audience; `sub`, `iat`, `exp`, `jti` present; `exp`, `nbf` and `iat` within
-30 s of clock tolerance; `exp - iat` and token age at most 900 s; then the principal rules:
+30 s of clock tolerance; `exp - iat` and token age at most 900 s (`maxLifetimeSec`, one number or
+`{ user, service }`); then the principal rules:
 
 - **User:** `actorType: "USER"`, a `sessionId`, a `clientId` other than the subject, string-array
   `permissions` and (optional) `roles`. With `userinfoUrl`, the session is confirmed online; the
-  answer is shared for 10 s from when the request started (failures for 2 s).
+  answer is shared for 10 s from when the request started (failures for 2 s), or not at all with
+  `sessionCacheTtlMs: 0`.
 - **Service:** `clientId` (or `client_id`) equals `sub`, `actorType: "SERVICE_ACCOUNT"`,
   `token_type: "access"`, no session.
 
@@ -129,13 +131,56 @@ const watch = watchStreamAuthorization({
 });
 ```
 
+Two options make the claim rules stricter for products that always required more:
+
+- `requireRoles: true` refuses a token without a `roles` array. The default (`false`) treats an
+  absent `roles` claim as no roles. A `roles` claim that is not a string array is always refused.
+- `clientIdClaim` chooses which claim names supply the client ID: `'clientId'` (Oathweave),
+  `'client_id'` (RFC 9068) or `'either'` (the default). When both claims are present they must
+  agree in every mode.
+
+#### Native issuers
+
+Oathweave signs browser-client tokens with its https issuer, but client-credentials tokens with its
+*native* issuer (its `JWT_ISSUER`, for example `hive-iam`) unless the client's machine policy selects
+the browser issuer. Both are signed by the same key and published in the same JWKS. List the native
+identifiers in `nativeIssuers` to accept those tokens too:
+
+```ts
+const verifier = createOathweaveVerifier({
+  issuer: process.env.OATHWEAVE_ISSUER!,  // still required, still https
+  nativeIssuers: ['hive-iam'],             // exact `iss` values; never accepted unless listed
+  audience: 'hivemem',
+  jwksUrl: process.env.OATHWEAVE_JWKS_URL!, // the one https JWKS serves both issuers
+  userinfoUrl: process.env.OATHWEAVE_USERINFO_URL,
+  accept: 'service',
+});
+```
+
+- Each entry must match `OATHWEAVE_NATIVE_ISSUER_PATTERN` (`^[a-z][a-z0-9-]{0,63}$`), so a URL or
+  any other shape is a startup error. There is no separate JWKS setting: `jwksUrl` (https, or
+  loopback http with `allowInsecureLoopback`) or `keys` verify both kinds of issuer.
+- A native issuer signs service principals only, by default: a user token from a native issuer is
+  refused with `invalid_issuer` before any session check. Suite user tokens come from browser
+  clients, which Oathweave always signs with the https issuer. `nativeIssuerAccept: 'any'` (or
+  `'user'`) changes that for a product that really takes native user tokens.
+- Every other rule (audience, lifetime, principal rules) is unchanged. `principal.issuer` is the
+  native identifier, so identity and service links keyed by `(issuer, clientId)` keep working.
+  `verifier.nativeIssuers` lists them; `verifier.issuers` still lists only the https issuers.
+
+Identity links name the local account `localUserId`. `localId`, the name older deployment configs
+use, is accepted as an alias; an entry that sets both to different values is refused. Parsed links
+always carry `localUserId`.
+
 Endpoints must be `https`. For tests against a loopback server, pass `allowInsecureLoopback: true`.
+Native issuer identifiers are names, not endpoints, and are never fetched.
 
 ### Conformance vectors
 
-`test-vectors/oathweave/vectors.json` ships a test JWKS and twelve pre-signed tokens (valid user,
+`test-vectors/oathweave/vectors.json` ships a test JWKS and fifteen pre-signed tokens (valid user,
 valid service, expired, not yet valid, wrong audience, wrong issuer, bad signature, unknown `kid`,
-`alg: none`, HS256 key confusion, overlong lifetime, user without session), evaluated at a fixed
+`alg: none`, HS256 key confusion, overlong lifetime, user without session, valid native-issuer
+service, unconfigured native issuer, overlong native-issuer service token), evaluated at a fixed
 clock so they never expire. Run them against your product's verifier:
 
 ```ts
@@ -144,13 +189,15 @@ import { runOathweaveConformance } from '@hivemagnus/hive-common/oathweave/confo
 it('meets the Oathweave conformance vectors', async () => {
   await runOathweaveConformance((token, ctx) => createProductVerifier({
     issuer: ctx.issuer, audience: ctx.audience, jwksUrl: ctx.jwksUrl, userinfoUrl: ctx.userinfoUrl,
+    nativeIssuers: ctx.nativeIssuers, // native issuers the vectors use, for service tokens
     fetch: ctx.fetch,          // serves the vectors' JWKS and userinfo
     now: () => ctx.nowMs,      // the fixed clock
   })(token));
 });
 ```
 
-It throws a readable error listing failed vectors. A refusal passes when the verifier rejects
+A verifier that does not accept native issuers fails `valid-native-service`; pass `only` to run
+the other vectors until it does. It throws a readable error listing failed vectors. A refusal passes when the verifier rejects
 (and any numeric `status` on the error matches); `strictReasons: true` also compares `reason`.
 
 ### errors
@@ -205,6 +252,16 @@ A check is down when it throws, returns `false` or `{ ok: false }`, or exceeds i
 `signal` aborts). Error text is hidden unless `exposeErrors: true`. Serve legacy aliases only
 while old clients still call them.
 
+A product that has published its own liveness body can keep it with `liveBody`: an object served
+as is, or a function that receives the standard body on every request. Status, headers and
+readiness are unchanged, and liveness still never runs checks. `liveness()`, `createHealth()`,
+`registerHealthRoutes()` and `hiveHandler({ health })` all take it.
+
+```ts
+createHealth({ service: 'studio', liveBody: { status: 'ok' } });
+createHealth({ service: 'hive-skills', liveBody: standard => ({ status: 'ok', service: standard.service, protocol: 1 }) });
+```
+
 ### context
 
 ```ts
@@ -221,6 +278,12 @@ Also `parseTraceparent()`, `formatTraceparent()`, `generateTraceparent()`, `chil
 `readRequestId()`, `requireIdempotencyKey()` (428 when missing). On an edge service exposed to the
 internet, pass `trustInbound: false` so callers cannot choose IDs.
 
+`trustInboundRequestId` and `trustInboundTrace` decide the request ID and the trace separately; each
+defaults to `trustInbound` (itself `true`). An internet-facing service that should still join its
+callers' traces passes `{ trustInboundRequestId: false, trustInboundTrace: true }`. The `/hono`
+`requestContext()` middleware and the `/node-http` `hiveHandler()` and `requestContextFor()` take
+the same options.
+
 ### registry
 
 ```ts
@@ -366,6 +429,55 @@ Behaviour that changes when a product adopts the shared verifier:
 - Duplicate identity links fail at startup by default (`duplicates: 'ignore'` keeps the old
   Magnus behaviour of granting nothing to that identity).
 
+## Choosing settings for an existing product
+
+The defaults suit a new service. A product moving from its own code to HiveCommon can keep its
+existing behaviour with these settings instead of wrapping the shared helpers:
+
+| Setting | Default | Set it to keep |
+| --- | --- | --- |
+| `clockToleranceSec: 0` (verifier) | 30 | no clock skew allowance on `exp`, `nbf` and `iat` |
+| `sessionCacheTtlMs: 0` (verifier) | 10 000 | an online session check on every request, so sign-out is immediate |
+| `requireRoles: true` (verifier) | `false` | refusing tokens without a `roles` array |
+| `clientIdClaim: 'clientId'` (verifier) | `'either'` | requiring the Oathweave `clientId` claim; RFC 9068 `client_id` alone is refused |
+| `nativeIssuers: ['hive-iam']` (verifier) | none | accepting client-credentials tokens signed with Oathweave's native issuer, which a local jose check used to handle |
+| `maxLifetimeSec: { user, service }` (verifier) | 900 for both | a different limit per principal kind, for example `{ user: 900, service: 300 }` |
+| `trustInboundRequestId: false` with `trustInboundTrace: true` (context, `/hono`, `/node-http`) | both `trustInbound` | generating every request ID on an internet-facing service while continuing callers' traces |
+| `liveBody` (health, `/hono`, `/node-http`) | the standard body | a published `/health/live` body such as `{ status: 'ok' }` |
+| `localId` in identity links | `localUserId` | existing link configs, unchanged |
+| `duplicates: 'ignore'` (identity links) | `'reject'` | granting nothing to a duplicated identity instead of failing at startup |
+
+```ts
+const verifier = createOathweaveVerifier({
+  issuer, audience: 'chattermost', jwksUrl, userinfoUrl,
+  clockToleranceSec: 0, sessionCacheTtlMs: 0, requireRoles: true, clientIdClaim: 'clientId',
+});
+app.use(requestContext({ trustInboundRequestId: false, trustInboundTrace: true }));
+registerHealthRoutes(app, { service: 'chattermost', liveBody: { status: 'ok' } });
+```
+
+Every refusal, including 503 `auth_unavailable`, is still an `OathweaveError`; a product that
+answers 401 for all of them maps the error in its own handler.
+
+Service tokens from a native issuer. Products that kept a local jose verifier for Oathweave's
+native issuer replace it with a second shared verifier on the same key source, so one JWKS cache
+serves both:
+
+```ts
+const keys = createRemoteJWKSet(new URL(jwksUrl)); // or let each verifier fetch jwksUrl itself
+const users = createOathweaveVerifier({ issuer, audience: 'hivemem', keys, userinfoUrl, /* user settings */ });
+const services = createOathweaveVerifier({
+  issuer,                                   // https; browser-issued machine clients use it
+  nativeIssuers: ['hive-iam'],              // Oathweave's JWT_ISSUER, from configuration
+  audience: 'hivemem', keys, accept: 'service',
+  clientIdClaim: 'clientId',                // Oathweave service tokens always carry clientId
+});
+```
+
+The fifteen-minute limit applies to service tokens as before (`maxLifetimeSec` sets it per kind).
+Native identifiers are exact: configure the value Oathweave's `JWT_ISSUER` is set to, and keep the
+service links that grant access keyed by that issuer.
+
 ## Development
 
 ```bash

package/dist/context/index.d.ts

@@ -66,9 +66,21 @@ export interface RequestContext {
 export interface CreateRequestContextOptions {
     /**
      * Accept the inbound request ID and trace context. Defaults to true; set false on an edge
-     * service that must not let the public internet choose its IDs.
+     * service that must not let the public internet choose its IDs. The two settings below
+     * override it for one of the two.
      */
     readonly trustInbound?: boolean;
+    /**
+     * Accept an inbound `x-request-id` (or `x-hive-request-id`, `x-correlation-id`). Defaults to
+     * `trustInbound`. When false, every request gets a generated ID.
+     */
+    readonly trustInboundRequestId?: boolean;
+    /**
+     * Continue an inbound `traceparent` and `tracestate`. Defaults to `trustInbound`. When false,
+     * every request starts a new trace. An internet-facing service can set this true with
+     * `trustInboundRequestId: false` to join a caller's trace while choosing its own request IDs.
+     */
+    readonly trustInboundTrace?: boolean;
     readonly generateRequestId?: () => string;
     readonly now?: () => number;
 }

package/dist/context/index.js

@@ -147,8 +147,10 @@ export function requireIdempotencyKey(headers) {
 }
 export function createRequestContext(headers, options = {}) {
     const trust = options.trustInbound ?? true;
-    const requestId = (trust ? readRequestId(headers) : undefined) ?? (options.generateRequestId ?? generateRequestId)();
-    const parentTrace = trust ? parseTraceparent(readHeader(headers, HIVE_HEADERS.traceparent)) : undefined;
+    const trustRequestId = options.trustInboundRequestId ?? trust;
+    const trustTrace = options.trustInboundTrace ?? trust;
+    const requestId = (trustRequestId ? readRequestId(headers) : undefined) ?? (options.generateRequestId ?? generateRequestId)();
+    const parentTrace = trustTrace ? parseTraceparent(readHeader(headers, HIVE_HEADERS.traceparent)) : undefined;
     const rawState = parentTrace ? readHeader(headers, HIVE_HEADERS.tracestate)?.trim() : undefined;
     // eslint-disable-next-line no-control-regex
     const tracestate = rawState && rawState.length <= 512 && !/[\u0000-\u001f\u007f]/.test(rawState) ? rawState : undefined;

package/dist/health/index.d.ts

@@ -51,7 +51,13 @@ export interface HealthResponse<B> {
     readonly body: B;
     readonly headers: Readonly<Record<string, string>>;
 }
-export interface HealthOptions {
+/**
+ * A product's own liveness body, in place of the standard `LiveBody`: an object served as is,
+ * or a function called on every liveness request with the standard body.
+ */
+export type LiveBodyOverride<L extends object> = L | ((standard: LiveBody) => L);
+/** `L` is the liveness body type: `LiveBody` unless `liveBody` is set. */
+export interface HealthOptions<L extends object = LiveBody> {
     readonly service?: string;
     readonly version?: string;
     readonly checks?: readonly HealthCheck[];
@@ -65,21 +71,31 @@ export interface HealthOptions {
     /** Also serve the legacy paths in `LEGACY_HEALTH_ALIASES`, or a custom alias map. */
     readonly aliases?: boolean | Partial<Readonly<Record<HealthKind, readonly string[]>>>;
     readonly now?: () => number;
+    /**
+     * Serve this body from `/health/live` instead of the standard one, for a product that keeps
+     * a published liveness body such as `{ status: 'ok' }`. The status (200) and headers are
+     * unchanged, and liveness still never runs checks. Readiness is not affected.
+     */
+    readonly liveBody?: LiveBodyOverride<L>;
 }
-/** The liveness response: 200 whenever the process can answer. It never runs checks. */
-export declare function liveness(options?: HealthOptions): HealthResponse<LiveBody>;
+/**
+ * The liveness response: 200 whenever the process can answer. It never runs checks. The body
+ * is the standard `LiveBody`, or the product's own when `liveBody` is set.
+ */
+export declare function liveness<L extends object = LiveBody>(options?: HealthOptions<L>): HealthResponse<L>;
 /** Run every check concurrently and build the readiness response: 503 if a critical check is down. */
-export declare function readiness(options?: HealthOptions): Promise<HealthResponse<ReadyBody>>;
+export declare function readiness(options?: HealthOptions<object>): Promise<HealthResponse<ReadyBody>>;
 /** Which health endpoint a path names, including legacy aliases when enabled. */
 export declare function resolveHealthPath(pathname: string, aliases?: HealthOptions['aliases']): HealthKind | undefined;
 /** All paths served for each kind, standard first. */
 export declare function healthPaths(aliases?: HealthOptions['aliases']): Readonly<Record<HealthKind, readonly string[]>>;
-export interface Health {
-    live(): HealthResponse<LiveBody>;
+/** `L` is the liveness body type: `LiveBody` unless `liveBody` was set. */
+export interface Health<L extends object = LiveBody> {
+    live(): HealthResponse<L>;
     ready(): Promise<HealthResponse<ReadyBody>>;
     /** The response for a health path, or undefined when the path is not a health path. */
-    handle(pathname: string): Promise<HealthResponse<LiveBody | ReadyBody>> | undefined;
+    handle(pathname: string): Promise<HealthResponse<L | ReadyBody>> | undefined;
     readonly paths: Readonly<Record<HealthKind, readonly string[]>>;
 }
 /** Bind options once and serve both endpoints. */
-export declare function createHealth(options?: HealthOptions): Health;
+export declare function createHealth<L extends object = LiveBody>(options?: HealthOptions<L>): Health<L>;

package/dist/health/index.js

@@ -12,10 +12,22 @@ const HEADERS = { 'content-type': 'application/json; charset=utf-8', 'cache-cont
 function identity(options) {
     return { ...(options.service ? { service: options.service } : {}), ...(options.version ? { version: options.version } : {}) };
 }
-/** The liveness response: 200 whenever the process can answer. It never runs checks. */
+function assertLiveBody(value) {
+    if (value !== undefined && typeof value !== 'function' && (typeof value !== 'object' || value === null || Array.isArray(value))) {
+        throw new TypeError('liveBody must be an object or a function');
+    }
+}
+/**
+ * The liveness response: 200 whenever the process can answer. It never runs checks. The body
+ * is the standard `LiveBody`, or the product's own when `liveBody` is set.
+ */
 export function liveness(options = {}) {
+    assertLiveBody(options.liveBody);
     const now = options.now ?? Date.now;
-    return { status: 200, body: { status: 'live', ...identity(options), time: new Date(now()).toISOString() }, headers: HEADERS };
+    const standard = { status: 'live', ...identity(options), time: new Date(now()).toISOString() };
+    const custom = options.liveBody;
+    const body = custom === undefined ? standard : typeof custom === 'function' ? custom(standard) : { ...custom };
+    return { status: 200, body: body, headers: HEADERS };
 }
 class CheckTimeout extends Error {
 }
@@ -97,6 +109,7 @@ function aliasMap(aliases) {
 }
 /** Bind options once and serve both endpoints. */
 export function createHealth(options = {}) {
+    assertLiveBody(options.liveBody);
     return {
         live: () => liveness(options),
         ready: () => readiness(options),

package/dist/hono/index.d.ts

@@ -11,7 +11,7 @@
  */
 import type { Context, Env, ErrorHandler, Hono, MiddlewareHandler, NotFoundHandler } from 'hono';
 import { type CreateRequestContextOptions, type RequestContext } from '../context/index.js';
-import { type HealthOptions } from '../health/index.js';
+import { type HealthOptions, type LiveBody } from '../health/index.js';
 import type { Logger } from '../log/index.js';
 import type { AcceptPrincipal, OathweavePrincipal } from '../oathweave/claims.js';
 import { type PermissionOptions } from '../oathweave/links.js';
@@ -60,5 +60,8 @@ export interface ErrorHandlerOptions {
 export declare function errorHandler(options?: ErrorHandlerOptions): ErrorHandler;
 /** `app.notFound(notFoundHandler())`: a 404 envelope. */
 export declare function notFoundHandler(): NotFoundHandler;
-/** Serve `/health/live`, `/health/ready` and any aliases on `app` (GET and HEAD). */
-export declare function registerHealthRoutes<E extends Env>(app: Hono<E>, options?: HealthOptions): void;
+/**
+ * Serve `/health/live`, `/health/ready` and any aliases on `app` (GET and HEAD). Set
+ * `liveBody` to keep a product's published liveness body.
+ */
+export declare function registerHealthRoutes<E extends Env, L extends object = LiveBody>(app: Hono<E>, options?: HealthOptions<L>): void;

package/dist/hono/index.js

@@ -91,7 +91,10 @@ export function errorHandler(options = {}) {
 export function notFoundHandler() {
     return c => respond(c, HiveError.notFound(), {});
 }
-/** Serve `/health/live`, `/health/ready` and any aliases on `app` (GET and HEAD). */
+/**
+ * Serve `/health/live`, `/health/ready` and any aliases on `app` (GET and HEAD). Set
+ * `liveBody` to keep a product's published liveness body.
+ */
 export function registerHealthRoutes(app, options = {}) {
     const health = createHealth(options);
     const serve = (kind) => async (c) => {

package/dist/node-http/index.d.ts

@@ -24,11 +24,14 @@ export interface SendErrorOptions {
 }
 /** Send any thrown value as the error envelope. Non-HiveErrors become a logged, generic 500. */
 export declare function sendError(res: ServerResponse, error: unknown, options?: SendErrorOptions): void;
-/** Serve a health path. Returns true when `req` was a health request and has been answered. */
-export declare function handleHealth(req: IncomingMessage, res: ServerResponse, health: Health): Promise<boolean>;
+/**
+ * Serve a health path. Returns true when `req` was a health request and has been answered.
+ * The liveness body is the one `health` was created with (see `liveBody`).
+ */
+export declare function handleHealth(req: IncomingMessage, res: ServerResponse, health: Health<object>): Promise<boolean>;
 export interface HiveHandlerOptions extends CreateRequestContextOptions {
     /** Serve health endpoints before `handler` runs. */
-    readonly health?: HealthOptions | Health;
+    readonly health?: HealthOptions<object> | Health<object>;
     readonly logger?: Pick<Logger, 'error'>;
     /** Echo `x-request-id` on every response. Defaults to true. */
     readonly responseHeader?: boolean;

package/dist/node-http/index.js

@@ -46,7 +46,10 @@ export function sendError(res, error, options = {}) {
     });
     sendJson(res, response.status, response.body, response.headers);
 }
-/** Serve a health path. Returns true when `req` was a health request and has been answered. */
+/**
+ * Serve a health path. Returns true when `req` was a health request and has been answered.
+ * The liveness body is the one `health` was created with (see `liveBody`).
+ */
 export async function handleHealth(req, res, health) {
     if (req.method !== 'GET' && req.method !== 'HEAD')
         return false;

package/dist/oathweave/claims.d.ts

@@ -38,18 +38,42 @@ export interface OathweaveServicePrincipal extends PrincipalBase {
     readonly kind: 'service';
 }
 export type OathweavePrincipal = OathweaveUserPrincipal | OathweaveServicePrincipal;
-/** The client claim: Oathweave's `clientId`, or RFC 9068 `client_id`. Both present must agree. */
-export declare function clientIdOf(payload: JWTPayload): string | undefined;
+/**
+ * Which claim names carry the client ID: Oathweave's `clientId`, RFC 9068 `client_id`, or
+ * `either` (the default).
+ */
+export type ClientIdClaim = 'clientId' | 'client_id' | 'either';
+export declare const CLIENT_ID_CLAIMS: readonly ClientIdClaim[];
+/**
+ * The client claim: Oathweave's `clientId`, or RFC 9068 `client_id`. Both present must agree,
+ * whichever name is accepted. With `clientId` or `client_id`, only that claim supplies the value.
+ */
+export declare function clientIdOf(payload: JWTPayload, claim?: ClientIdClaim): string | undefined;
 /** Scopes from `scope` (space-separated) or `scp` (array or string), de-duplicated. */
 export declare function extractScopes(payload: JWTPayload): string[];
-/** Roles; an absent claim is no roles. A present claim that is not a string array is invalid. */
-export declare function extractRoles(payload: JWTPayload): string[] | undefined;
+/**
+ * Roles; an absent claim is no roles, or invalid when `required` is true. A present claim that
+ * is not a string array is invalid.
+ */
+export declare function extractRoles(payload: JWTPayload, required?: boolean): string[] | undefined;
 /** A service token is one whose client ID equals its subject. */
-export declare function principalKindOf(payload: JWTPayload): PrincipalKind;
+export declare function principalKindOf(payload: JWTPayload, claim?: ClientIdClaim): PrincipalKind;
+/** A lifetime limit in seconds for each principal kind. */
+export interface OathweaveLifetimeLimits {
+    readonly user?: number;
+    readonly service?: number;
+}
 export interface ClaimPolicy {
     readonly accept: AcceptPrincipal;
-    /** Largest allowed `exp - iat`, in seconds. */
-    readonly maxLifetimeSec: number;
+    /**
+     * Largest allowed `exp - iat`, in seconds: one limit for every token, or one per principal
+     * kind. A kind missing from the object gets `OATHWEAVE_MAX_LIFETIME_SEC` (900).
+     */
+    readonly maxLifetimeSec: number | OathweaveLifetimeLimits;
+    /** Refuse a token without a `roles` claim. Defaults to false: an absent claim is no roles. */
+    readonly requireRoles?: boolean;
+    /** Which claim names supply the client ID. Defaults to `either`. */
+    readonly clientIdClaim?: ClientIdClaim;
 }
 /**
  * Check the Oathweave claim rules on a payload whose signature, issuer, audience and time

package/dist/oathweave/claims.js

@@ -1,17 +1,23 @@
 import { OathweaveError } from './errors.js';
+/** Mirrors `OATHWEAVE_MAX_LIFETIME_SEC`, which lives in the verifier module. */
+const MAX_LIFETIME_SEC = 900;
 function stringArray(value) {
     return Array.isArray(value) && value.every(item => typeof item === 'string');
 }
 function nonEmpty(value) {
     return typeof value === 'string' && value.length > 0;
 }
-/** The client claim: Oathweave's `clientId`, or RFC 9068 `client_id`. Both present must agree. */
-export function clientIdOf(payload) {
+export const CLIENT_ID_CLAIMS = ['clientId', 'client_id', 'either'];
+/**
+ * The client claim: Oathweave's `clientId`, or RFC 9068 `client_id`. Both present must agree,
+ * whichever name is accepted. With `clientId` or `client_id`, only that claim supplies the value.
+ */
+export function clientIdOf(payload, claim = 'either') {
     const camel = payload['clientId'];
     const snake = payload['client_id'];
     if (camel !== undefined && snake !== undefined && camel !== snake)
         return undefined;
-    const value = camel ?? snake;
+    const value = claim === 'clientId' ? camel : claim === 'client_id' ? snake : camel ?? snake;
     return typeof value === 'string' ? value : undefined;
 }
 /** Scopes from `scope` (space-separated) or `scp` (array or string), de-duplicated. */
@@ -20,16 +26,19 @@ export function extractScopes(payload) {
     const list = typeof raw === 'string' ? raw.split(/\s+/) : stringArray(raw) ? raw : [];
     return [...new Set(list.map(item => item.trim()).filter(Boolean))];
 }
-/** Roles; an absent claim is no roles. A present claim that is not a string array is invalid. */
-export function extractRoles(payload) {
+/**
+ * Roles; an absent claim is no roles, or invalid when `required` is true. A present claim that
+ * is not a string array is invalid.
+ */
+export function extractRoles(payload, required = false) {
     const roles = payload['roles'];
     if (roles === undefined)
-        return [];
+        return required ? undefined : [];
     return stringArray(roles) ? [...roles] : undefined;
 }
 /** A service token is one whose client ID equals its subject. */
-export function principalKindOf(payload) {
-    const clientId = clientIdOf(payload);
+export function principalKindOf(payload, claim = 'either') {
+    const clientId = clientIdOf(payload, claim);
     return clientId !== undefined && clientId === payload.sub ? 'service' : 'user';
 }
 function validAuthTime(value) {
@@ -45,17 +54,19 @@ function validAuthTime(value) {
  */
 export function principalFromClaims(payload, policy) {
     const { iat, exp, sub, jti, iss } = payload;
-    if (typeof iat !== 'number' || typeof exp !== 'number' || exp <= iat || exp - iat > policy.maxLifetimeSec) {
+    const clientIdClaim = policy.clientIdClaim ?? 'either';
+    const kind = principalKindOf(payload, clientIdClaim);
+    const maxLifetimeSec = typeof policy.maxLifetimeSec === 'number' ? policy.maxLifetimeSec : policy.maxLifetimeSec[kind] ?? MAX_LIFETIME_SEC;
+    if (typeof iat !== 'number' || typeof exp !== 'number' || exp <= iat || exp - iat > maxLifetimeSec) {
         throw new OathweaveError('invalid_lifetime');
     }
     if (!nonEmpty(sub) || !nonEmpty(jti) || !nonEmpty(iss))
         throw new OathweaveError('invalid_claims');
     const permissions = payload['permissions'];
-    const roles = extractRoles(payload);
-    const clientId = clientIdOf(payload);
+    const roles = extractRoles(payload, policy.requireRoles ?? false);
+    const clientId = clientIdOf(payload, clientIdClaim);
     if (!stringArray(permissions) || roles === undefined || clientId === undefined)
         throw new OathweaveError('invalid_claims');
-    const kind = principalKindOf(payload);
     if (policy.accept !== 'any' && policy.accept !== kind)
         throw new OathweaveError('wrong_principal_kind', { details: { kind } });
     const base = {

package/dist/oathweave/conformance.d.ts

@@ -25,6 +25,8 @@ export interface ConformanceVector {
 export interface ConformanceVectors {
     readonly schema: 1;
     readonly issuer: string;
+    /** Native issuer identifiers the verifier under test must be configured to accept. */
+    readonly nativeIssuers?: readonly string[];
     readonly audience: string;
     readonly jwksUrl: string;
     readonly userinfoUrl: string;
@@ -35,6 +37,11 @@ export interface ConformanceVectors {
 }
 export interface ConformanceContext {
     readonly issuer: string;
+    /**
+     * Native issuer identifiers (such as `hive-iam`) to configure alongside `issuer`, for service
+     * tokens. Empty when the vectors have none.
+     */
+    readonly nativeIssuers: readonly string[];
     readonly audience: string;
     readonly jwks: JSONWebKeySet;
     readonly jwksUrl: string;

package/dist/oathweave/conformance.js

@@ -76,6 +76,7 @@ export async function runOathweaveConformance(verify, options = {}) {
             continue;
         const context = {
             issuer: vectors.issuer,
+            nativeIssuers: vectors.nativeIssuers ?? [],
             audience: vectors.audience,
             jwks: vectors.jwks,
             jwksUrl: vectors.jwksUrl,
@@ -116,6 +117,7 @@ export async function runOathweaveConformance(verify, options = {}) {
 export function hiveCommonConformanceVerify() {
     return (token, context) => createOathweaveVerifier({
         issuer: context.issuer,
+        nativeIssuers: context.nativeIssuers,
         audience: context.audience,
         keys: context.jwks,
         now: () => context.nowMs,

package/dist/oathweave/index.d.ts

@@ -2,8 +2,8 @@
  * `@hivemagnus/hive-common/oathweave`: Oathweave access-token verification for suite services.
  * Framework-free; see `/hono` and `/node-http` for middleware.
  */
-export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, type OathweaveVerifier, type OathweaveVerifierOptions, type VerifyOptions, } from './verifier.js';
-export { clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, type AcceptPrincipal, type ClaimPolicy, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal, type PrincipalKind, } from './claims.js';
+export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_NATIVE_ISSUER_PATTERN, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, type OathweaveVerifier, type OathweaveVerifierOptions, type VerifyOptions, } from './verifier.js';
+export { CLIENT_ID_CLAIMS, clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, type AcceptPrincipal, type ClaimPolicy, type ClientIdClaim, type OathweaveLifetimeLimits, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal, type PrincipalKind, } from './claims.js';
 export { OathweaveError, isOathweaveError, statusForReason, type OathweaveFailureReason } from './errors.js';
 export { assertOathweaveEndpoint, endpointProblem, isLoopbackHost, isOathweaveEndpoint, type EndpointOptions } from './endpoint.js';
 export { effectivePermissions, hasAnyRole, hasPermissions, hasScopes, IdentityLinkError, parseIdentityLinks, permissionMatches, requireIdentityLink, requirePermissions, uniqueIdentityLink, type OathweaveIdentityLink, type ParseIdentityLinksOptions, type PermissionOptions, } from './links.js';

package/dist/oathweave/index.js

@@ -2,8 +2,8 @@
  * `@hivemagnus/hive-common/oathweave`: Oathweave access-token verification for suite services.
  * Framework-free; see `/hono` and `/node-http` for middleware.
  */
-export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from './verifier.js';
-export { clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, } from './claims.js';
+export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_NATIVE_ISSUER_PATTERN, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from './verifier.js';
+export { CLIENT_ID_CLAIMS, clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, } from './claims.js';
 export { OathweaveError, isOathweaveError, statusForReason } from './errors.js';
 export { assertOathweaveEndpoint, endpointProblem, isLoopbackHost, isOathweaveEndpoint } from './endpoint.js';
 export { effectivePermissions, hasAnyRole, hasPermissions, hasScopes, IdentityLinkError, parseIdentityLinks, permissionMatches, requireIdentityLink, requirePermissions, uniqueIdentityLink, } from './links.js';

package/dist/oathweave/links.d.ts

@@ -33,6 +33,8 @@ export interface ParseIdentityLinksOptions {
 }
 /**
  * Parse a JSON array of links, for example from `<PRODUCT>_OATHWEAVE_IDENTITIES_JSON`.
+ * An entry may name its local account `localUserId` or, as older configs do, `localId`; an
+ * entry that sets both to different values is refused. Parsed links always use `localUserId`.
  * Throws an `IdentityLinkError` naming the first problem; the raw value is never echoed.
  */
 export declare function parseIdentityLinks(raw: string | unknown, options?: ParseIdentityLinksOptions): OathweaveIdentityLink[];

package/dist/oathweave/links.js

@@ -2,7 +2,8 @@ import { OathweaveError } from './errors.js';
 export class IdentityLinkError extends Error {
     name = 'IdentityLinkError';
 }
-const LINK_FIELDS = new Set(['issuer', 'subject', 'localUserId', 'role', 'displayName', 'permissions']);
+/** `localId` is accepted as an alias of `localUserId`, the name older deployment configs use. */
+const LINK_FIELDS = new Set(['issuer', 'subject', 'localUserId', 'localId', 'role', 'displayName', 'permissions']);
 function isHttpsUrl(value) {
     if (typeof value !== 'string')
         return false;
@@ -15,6 +16,8 @@ function isHttpsUrl(value) {
 }
 /**
  * Parse a JSON array of links, for example from `<PRODUCT>_OATHWEAVE_IDENTITIES_JSON`.
+ * An entry may name its local account `localUserId` or, as older configs do, `localId`; an
+ * entry that sets both to different values is refused. Parsed links always use `localUserId`.
  * Throws an `IdentityLinkError` naming the first problem; the raw value is never echoed.
  */
 export function parseIdentityLinks(raw, options = {}) {
@@ -40,7 +43,11 @@ export function parseIdentityLinks(raw, options = {}) {
         for (const key of Object.keys(link))
             if (!LINK_FIELDS.has(key))
                 throw new IdentityLinkError(`${where} has unknown field ${key.slice(0, 40)}`);
-        const { issuer, subject, localUserId, role, displayName, permissions } = link;
+        const { issuer, subject, localId, role, displayName, permissions } = link;
+        if (link['localUserId'] !== undefined && localId !== undefined && link['localUserId'] !== localId) {
+            throw new IdentityLinkError(`${where}: localId and localUserId disagree`);
+        }
+        const localUserId = link['localUserId'] ?? localId;
         if (!isHttpsUrl(issuer))
             throw new IdentityLinkError(`${where}: issuer must be an https URL`);
         if (typeof subject !== 'string' || !subject || subject.length > 256)

package/dist/oathweave/verifier.d.ts

@@ -1,5 +1,5 @@
 import { type JSONWebKeySet, type JWTVerifyGetKey } from 'jose';
-import { type AcceptPrincipal, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal } from './claims.js';
+import { type AcceptPrincipal, type ClientIdClaim, type OathweaveLifetimeLimits, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal } from './claims.js';
 import { type EndpointOptions } from './endpoint.js';
 /** How long a userinfo answer is reused, measured from when its request started. */
 export declare const OATHWEAVE_SESSION_CACHE_TTL_MS = 10000;
@@ -14,9 +14,28 @@ export declare const OATHWEAVE_MAX_LIFETIME_SEC = 900;
 export declare const OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC = 30;
 /** Longest accepted compact token. Real Oathweave tokens are well under 4 KiB. */
 export declare const OATHWEAVE_MAX_TOKEN_LENGTH = 16384;
+/**
+ * What a native issuer identifier must look like: a lowercase name such as `hive-iam`, never a
+ * URL, so it cannot be confused with an https issuer.
+ */
+export declare const OATHWEAVE_NATIVE_ISSUER_PATTERN: RegExp;
 export interface OathweaveVerifierOptions extends EndpointOptions {
     /** Accepted issuer, or issuers. Each must be an https URL. */
     readonly issuer: string | readonly string[];
+    /**
+     * Oathweave's native issuer identifiers (its `JWT_ISSUER`, for example `hive-iam`) to accept
+     * as well. Oathweave signs client-credentials tokens with its native issuer unless the
+     * client's policy selects the browser issuer, and with the same keys, so these tokens are
+     * verified against the same `jwksUrl` or `keys`. Each must match
+     * `OATHWEAVE_NATIVE_ISSUER_PATTERN`. Defaults to none: a native issuer is never accepted
+     * unless it is listed here.
+     */
+    readonly nativeIssuers?: readonly string[];
+    /**
+     * Which principals a native issuer may sign for. Defaults to `service`: suite user tokens
+     * come from browser clients, which Oathweave always signs with the https issuer.
+     */
+    readonly nativeIssuerAccept?: AcceptPrincipal;
     /** This service's resource audience, for example `hivemem`. Matched exactly. */
     readonly audience: string;
     /** The issuer's JWKS endpoint. Required unless `keys` is given. */
@@ -32,8 +51,11 @@ export interface OathweaveVerifierOptions extends EndpointOptions {
     readonly accept?: AcceptPrincipal;
     /** Seconds of clock skew tolerated on `exp`, `nbf` and `iat`. Defaults to 30. */
     readonly clockToleranceSec?: number;
-    /** Largest `exp - iat` and token age in seconds. Defaults to 900. */
-    readonly maxLifetimeSec?: number;
+    /**
+     * Largest `exp - iat` and token age in seconds: one limit for every token, or one per
+     * principal kind (`{ user: 900, service: 300 }`). Each defaults to 900.
+     */
+    readonly maxLifetimeSec?: number | OathweaveLifetimeLimits;
     readonly fetch?: typeof fetch;
     /** Clock in epoch milliseconds. */
     readonly now?: () => number;
@@ -42,15 +64,32 @@ export interface OathweaveVerifierOptions extends EndpointOptions {
     readonly jwksCacheMaxAgeMs?: number;
     /** Minimum time between refetches triggered by an unknown `kid` (key rotation). Defaults to 30 s. */
     readonly jwksCooldownMs?: number;
+    /**
+     * How long a userinfo answer is reused, in milliseconds. Defaults to 10 000; 0 checks the
+     * session online on every call.
+     */
     readonly sessionCacheTtlMs?: number;
     readonly sessionCacheMax?: number;
+    /**
+     * Refuse a token without a `roles` array. Defaults to false, where an absent `roles` claim
+     * means no roles. A present claim that is not a string array is always refused.
+     */
+    readonly requireRoles?: boolean;
+    /**
+     * Which claim names supply the client ID: `clientId` (Oathweave), `client_id` (RFC 9068) or
+     * `either` (the default). When both claims are present they must agree in every mode.
+     */
+    readonly clientIdClaim?: ClientIdClaim;
 }
 export interface VerifyOptions {
     /** Override the verifier's default `accept` for this call. */
     readonly accept?: AcceptPrincipal;
 }
 export interface OathweaveVerifier {
+    /** The accepted https issuers. */
     readonly issuers: readonly string[];
+    /** The accepted native issuer identifiers; empty unless configured. */
+    readonly nativeIssuers: readonly string[];
     readonly audience: string;
     verify(token: string, options?: VerifyOptions): Promise<OathweavePrincipal>;
     verifyUser(token: string): Promise<OathweaveUserPrincipal>;

package/dist/oathweave/verifier.js

@@ -7,7 +7,7 @@
  */
 import { createHash } from 'node:crypto';
 import { createLocalJWKSet, createRemoteJWKSet, customFetch, decodeProtectedHeader, errors as joseErrors, jwtVerify, } from 'jose';
-import { principalFromClaims, } from './claims.js';
+import { CLIENT_ID_CLAIMS, principalFromClaims, } from './claims.js';
 import { assertOathweaveEndpoint } from './endpoint.js';
 import { OathweaveError } from './errors.js';
 /** How long a userinfo answer is reused, measured from when its request started. */
@@ -23,6 +23,11 @@ export const OATHWEAVE_MAX_LIFETIME_SEC = 900;
 export const OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC = 30;
 /** Longest accepted compact token. Real Oathweave tokens are well under 4 KiB. */
 export const OATHWEAVE_MAX_TOKEN_LENGTH = 16_384;
+/**
+ * What a native issuer identifier must look like: a lowercase name such as `hive-iam`, never a
+ * URL, so it cannot be confused with an https issuer.
+ */
+export const OATHWEAVE_NATIVE_ISSUER_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
 const BEARER = /^Bearer[ ]+([A-Za-z0-9\-._~+/]+=*)[ ]*$/i;
 /**
  * The token in an `Authorization: Bearer` header (RFC 6750). Undefined when there is no
@@ -91,6 +96,31 @@ function mapVerifyError(error) {
     // JOSEAlgNotAllowed cannot occur: the header precheck already refused every algorithm but RS256.
     return new OathweaveError('malformed_token');
 }
+const ACCEPT_VALUES = ['user', 'service', 'any'];
+/** Validate the configured native issuer identifiers. */
+function nativeIssuerList(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new TypeError('Oathweave nativeIssuers must be an array');
+    for (const issuer of value) {
+        if (typeof issuer !== 'string' || !OATHWEAVE_NATIVE_ISSUER_PATTERN.test(issuer)) {
+            throw new TypeError('Oathweave nativeIssuers entries must be lowercase identifiers such as hive-iam');
+        }
+    }
+    return [...new Set(value)];
+}
+/** Resolve `maxLifetimeSec` into one limit per principal kind. */
+function lifetimeLimits(value) {
+    const limits = typeof value === 'object' && value !== null
+        ? { user: value.user ?? OATHWEAVE_MAX_LIFETIME_SEC, service: value.service ?? OATHWEAVE_MAX_LIFETIME_SEC }
+        : { user: value ?? OATHWEAVE_MAX_LIFETIME_SEC, service: value ?? OATHWEAVE_MAX_LIFETIME_SEC };
+    for (const limit of [limits.user, limits.service]) {
+        if (!(typeof limit === 'number' && limit > 0 && limit <= 86_400))
+            throw new TypeError('maxLifetimeSec must be 1-86400');
+    }
+    return limits;
+}
 /** Create a verifier. Throws a TypeError at startup when the configuration is unsafe. */
 export function createOathweaveVerifier(options) {
     const issuers = typeof options.issuer === 'string' ? [options.issuer] : [...options.issuer];
@@ -98,6 +128,10 @@ export function createOathweaveVerifier(options) {
         throw new TypeError('At least one Oathweave issuer is required');
     for (const issuer of issuers)
         assertOathweaveEndpoint(issuer, 'issuer', options);
+    const nativeIssuers = nativeIssuerList(options.nativeIssuers);
+    const nativeIssuerAccept = options.nativeIssuerAccept ?? 'service';
+    if (!ACCEPT_VALUES.includes(nativeIssuerAccept))
+        throw new TypeError("nativeIssuerAccept must be 'user', 'service' or 'any'");
     if (options.jwksUrl !== undefined)
         assertOathweaveEndpoint(options.jwksUrl, 'jwksUrl', options);
     if (options.userinfoUrl !== undefined)
@@ -105,16 +139,21 @@ export function createOathweaveVerifier(options) {
     if (typeof options.audience !== 'string' || !options.audience)
         throw new TypeError('Oathweave audience is required');
     const clockTolerance = options.clockToleranceSec ?? OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC;
-    const maxLifetimeSec = options.maxLifetimeSec ?? OATHWEAVE_MAX_LIFETIME_SEC;
+    const lifetimes = lifetimeLimits(options.maxLifetimeSec);
     if (!(clockTolerance >= 0 && clockTolerance <= 300))
         throw new TypeError('clockToleranceSec must be 0-300');
-    if (!(maxLifetimeSec > 0 && maxLifetimeSec <= 86_400))
-        throw new TypeError('maxLifetimeSec must be 1-86400');
+    const requireRoles = options.requireRoles ?? false;
+    const clientIdClaim = options.clientIdClaim ?? 'either';
+    if (typeof requireRoles !== 'boolean')
+        throw new TypeError('requireRoles must be a boolean');
+    if (!CLIENT_ID_CLAIMS.includes(clientIdClaim))
+        throw new TypeError("clientIdClaim must be 'clientId', 'client_id' or 'either'");
     const defaultAccept = options.accept ?? 'user';
     const timeoutMs = options.requestTimeoutMs ?? OATHWEAVE_REQUEST_TIMEOUT_MS;
     const request = options.fetch ?? ((input, init) => fetch(input, init));
     const now = options.now ?? Date.now;
     const keys = keySource(options, request, timeoutMs);
+    const acceptedIssuers = [...issuers, ...nativeIssuers];
     const sessionTtl = options.sessionCacheTtlMs ?? OATHWEAVE_SESSION_CACHE_TTL_MS;
     const sessionMax = options.sessionCacheMax ?? OATHWEAVE_SESSION_CACHE_MAX;
     // Holds only tokens whose signature verified, so garbage can neither fill it nor reach userinfo.
@@ -188,10 +227,11 @@ export function createOathweaveVerifier(options) {
         try {
             ({ payload } = await jwtVerify(token, keys, {
                 algorithms: ['RS256'],
-                issuer: issuers,
+                issuer: acceptedIssuers,
                 audience: options.audience,
                 requiredClaims: ['sub', 'iat', 'exp', 'jti'],
-                maxTokenAge: maxLifetimeSec,
+                // The per-kind limit is checked on `exp - iat` below, which also bounds the age.
+                maxTokenAge: Math.max(lifetimes.user, lifetimes.service),
                 clockTolerance,
                 currentDate: new Date(now()),
             }));
@@ -202,7 +242,16 @@ export function createOathweaveVerifier(options) {
         // jose accepts an audience array that contains ours; Oathweave issues exactly one audience.
         if (payload.aud !== options.audience)
             throw new OathweaveError('invalid_audience');
-        const principal = principalFromClaims(payload, { accept: verifyOptions.accept ?? defaultAccept, maxLifetimeSec });
+        const principal = principalFromClaims(payload, {
+            accept: verifyOptions.accept ?? defaultAccept,
+            maxLifetimeSec: lifetimes,
+            requireRoles,
+            clientIdClaim,
+        });
+        // A native issuer signs only the principals it was configured for.
+        if (nativeIssuers.includes(principal.issuer) && nativeIssuerAccept !== 'any' && nativeIssuerAccept !== principal.kind) {
+            throw new OathweaveError('invalid_issuer');
+        }
         if (principal.kind === 'user' && options.userinfoUrl) {
             const displayName = await sessionCheck(token, principal.subject);
             return { ...principal, displayName, sessionChecked: true };
@@ -211,6 +260,7 @@ export function createOathweaveVerifier(options) {
     }
     return {
         issuers,
+        nativeIssuers,
         audience: options.audience,
         verify,
         verifyUser: token => verify(token, { accept: 'user' }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/hive-common",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Shared server kit for the Hive:Magnus suite: Oathweave token verification, error envelope, health, request context, registry client, logging, events and framework adapters",
   "keywords": [
     "hive",

package/test-vectors/README.md

@@ -3,8 +3,8 @@
 `oathweave/vectors.json` holds a test JWKS and pre-signed Oathweave access tokens with the
 outcome every suite verifier must produce. `oathweave/jwks.json` is the same JWKS on its own.
 
-All tokens are synthetic: the issuer is `https://oathweave.example.test`, the audience is
-`conformance`, and the signing keys were discarded after generation. Evaluate them at the fixed
+All tokens are synthetic: the issuer is `https://oathweave.example.test`, the native issuer
+(`nativeIssuers`) is `conformance-iam`, the audience is `conformance`, and the signing keys were discarded after generation. Evaluate them at the fixed
 time in `now` (`2026-01-01T00:00:00Z`), because Oathweave tokens live at most fifteen minutes.
 
 | Vector | Expected |
@@ -21,7 +21,11 @@ time in `now` (`2026-01-01T00:00:00Z`), because Oathweave tokens live at most fi
 | `hs256-confusion` | 401 `algorithm_not_allowed` |
 | `lifetime-too-long` | 401 `invalid_lifetime` |
 | `user-without-session` | 401 `invalid_claims` |
+| `valid-native-service` | accept, service principal signed with the native issuer |
+| `unconfigured-native-issuer` | 401 `invalid_issuer` |
+| `native-service-lifetime-too-long` | 401 `invalid_lifetime` |
 
-Run them with `runOathweaveConformance()` from `@hivemagnus/hive-common/oathweave/conformance`.
+Configure the verifier under test with `nativeIssuers` from the file (the runner passes them as
+`ctx.nativeIssuers`). Run them with `runOathweaveConformance()` from `@hivemagnus/hive-common/oathweave/conformance`.
 Regenerate with `npm run vectors:generate` in the HiveCommon repository; that replaces every
 token and key, so it is a changelog-worthy change.

package/test-vectors/oathweave/jwks.json

@@ -2,7 +2,7 @@
   "keys": [
     {
       "kty": "RSA",
-      "n": "golRKNCwa4EHgHIg8TdQPKbdQ2ZcEyA86q-Nnhlpv77c8ivnED12nAcQC29yuR7aUkLNH1FJHvbChiXndB_PqDk_AtF_fmm0XPhdKthO6GPZOjLEX5LeWzFilQ4EmgieFIOAa-4LvWZfuvqsX2jXkbABiDFnJKwQ2hfegLTGkmqRQfEfBIZZcTlGI3tVjLV2B8Fh1cutNyUpCAtTFMUBUleioFtA9BzuIl3pBJ4Q3aBMxDvkAcaV7o9FpSz5Z1bfXUaNxi_k3jfdZh8OYStAQD0SPNWjt_Wannm9N_cSVl34jMmnFBUtyiAOHf8jVZeYtcVF75RtUJRg-QopglyIow",
+      "n": "yqMr7bkXQ5W1vFW-cIyvEdkdZNAdJ6S3JsmE88aLNyNTDSM8cPskt-1ZntDBFqVc2SyhMtpPHr6zQHo8EkG6VU8vmg0u-X7whM63Pnj3xM-NNJlMCyUfH66imW2N-rITu-cyCOMmWN6WprFzhsXAR4bTw8qnuVfBHQ19fKwRhOHZuTFEQbK_OUj0k_GgzOWVyaoRnCW3_AnesQuBwp68f2JEwllYRYX2vv75Q9ckl8pstGS3E1AAtgPrGp7nAxvbmQHoMlS1xYppZuWjoUttb7qVttduuMESpFva5oDqol5xKe9J0_dP9ZPEWInpzV7LfWgkry21asEIwojglTFgaQ",
       "e": "AQAB",
       "kid": "conformance-1",
       "alg": "RS256",

package/test-vectors/oathweave/vectors.json

@@ -2,6 +2,9 @@
   "schema": 1,
   "description": "Oathweave access-token conformance vectors. Synthetic: the signing keys were discarded after generation.",
   "issuer": "https://oathweave.example.test",
+  "nativeIssuers": [
+    "conformance-iam"
+  ],
   "audience": "conformance",
   "jwksUrl": "https://oathweave.example.test/jwks",
   "userinfoUrl": "https://oathweave.example.test/userinfo",
@@ -10,7 +13,7 @@
     "keys": [
       {
         "kty": "RSA",
-        "n": "golRKNCwa4EHgHIg8TdQPKbdQ2ZcEyA86q-Nnhlpv77c8ivnED12nAcQC29yuR7aUkLNH1FJHvbChiXndB_PqDk_AtF_fmm0XPhdKthO6GPZOjLEX5LeWzFilQ4EmgieFIOAa-4LvWZfuvqsX2jXkbABiDFnJKwQ2hfegLTGkmqRQfEfBIZZcTlGI3tVjLV2B8Fh1cutNyUpCAtTFMUBUleioFtA9BzuIl3pBJ4Q3aBMxDvkAcaV7o9FpSz5Z1bfXUaNxi_k3jfdZh8OYStAQD0SPNWjt_Wannm9N_cSVl34jMmnFBUtyiAOHf8jVZeYtcVF75RtUJRg-QopglyIow",
+        "n": "yqMr7bkXQ5W1vFW-cIyvEdkdZNAdJ6S3JsmE88aLNyNTDSM8cPskt-1ZntDBFqVc2SyhMtpPHr6zQHo8EkG6VU8vmg0u-X7whM63Pnj3xM-NNJlMCyUfH66imW2N-rITu-cyCOMmWN6WprFzhsXAR4bTw8qnuVfBHQ19fKwRhOHZuTFEQbK_OUj0k_GgzOWVyaoRnCW3_AnesQuBwp68f2JEwllYRYX2vv75Q9ckl8pstGS3E1AAtgPrGp7nAxvbmQHoMlS1xYppZuWjoUttb7qVttduuMESpFva5oDqol5xKe9J0_dP9ZPEWInpzV7LfWgkry21asEIwojglTFgaQ",
         "e": "AQAB",
         "kid": "conformance-1",
         "alg": "RS256",
@@ -23,7 +26,7 @@
       "name": "valid-user",
       "description": "A user access token with a session, signed by the trusted key.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.H_M25DpT8q8xWyVFydzNrBQd6m1j1M_ziDq8yiLem2jgDoG2eetf_gGl0eUSwP-RuRlcykPvHGou1XZ3MIbbzaOP4AqxOr4aTl3HaxpXbYudYMG89ty5fcJKsFnT15zy61VjV0ZNkj734DrXDo04XbFnLuhi300ojsJpYJkWi6v-o3B-_DFVygHk_5ZNHA6hboIOCgv8ZO-kOWcHrw8Zr_VpwSmKxpj-5B8uLxXsEDb_WqGdHyXAFFt_dDjQb1dw9ssUtFhxRLE0kI2LXq6mjy_P76Z7bk_S1sSFGvMAWL_mh8QNzHspJ3CBhJmJ93JimimZu7EUpJb1vH8wIvmSVg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.h_xGzySHyRl_bLLqz7bRQfI6FXeeoFGX7WVhauLK9LUZG0tn5mtc89p6muVppqStzCpo9NtYJC-ZD1UpF_SU3CAUC7vBU8yRkVPHHGVR26nI5n29jjr1zocAHsKg0Aia7k8hWBRDdxkfxNC6clj0fzLRR2BHNlM0m4UrE29nyQItI5hYt49ngLl74ieFStYYCo1QxJR4_x0AjDcAOUtT-hATSalaBjuS9ASrGoHjhUmal-teXcUbzXV5LXQseY1IspAtx3ujIliFp4qVhCgD2DjGf0j-0vy6tD2NBNSZL6BRJfU8ODhVy9jw1drHj9HncPPgYbr9TT96qaFRklFMKw",
       "expect": {
         "outcome": "accept",
         "kind": "user",
@@ -45,7 +48,7 @@
       "name": "valid-service",
       "description": "A client-credentials token whose client ID equals its subject.",
       "principal": "service",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.GX3VfFVnjLp2mPZQn3nI8FkLUT52ZAZoV5QWfSpjGqycR7FRgvaK3ba0RUimrTKrK_2-DZAQOLKJ-TGPjsJDJnyCNbUY-0V63QkSSZ15nKyDWpE9M8ubjjNM5cblP4GpyUog6rdhZryShHp9Q6eyjFMOUDlr2eVcxIFF3kuIMn_rfrO8rAqyk8jHu5Qpld0lls3hQIxEIf4c3WZOviVFkUEdqYmhNwwDkCM7uVSaFKv_Sh48KYWIJVPQH46FjiGOXiDxfpCwEn8ox2ZUICL0YbM3k2XB7FI3V32Ao6D9brVQ5GzDINI6yXsZJ4ylbaVHbEbXgvtnHqojkrzfAZ7FXg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.OX7smVqC33kIdki0cnQvYIS3TTV2Hn9Pwdgh2jBJ4SHLq_ns3StMOqaDt9uz6QB7f52JM08a-e_JitdhbqPy6J7W2JIixaqV9mSC1_T8PEKRNdJ6TbkJ_zdnw4wG20VyFBOQqXz3uL8Y9hi4rk_qCmG3iXnRBTmTFw2Ra0J9ndS4Gd6oQH8VNkjBQzS6En-yNQpOEN0kn-ssYeidPJmvOkZ2Kglp4s8sri3OtF19clwcChrbChONJSITLpg6Ee3PBJIiye_h2HONCGeYbnEkKAuqUsnkmwR37rS-Eb58nOeR6A2tornF0iX1dXUShC-siuhalYOP03ijrsLh4Th0qw",
       "expect": {
         "outcome": "accept",
         "kind": "service",
@@ -64,7 +67,7 @@
       "name": "expired",
       "description": "Expired fifteen minutes before the evaluation time.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjM4MDAtMTc2NzIyNDcwMCIsImlhdCI6MTc2NzIyMzgwMCwiZXhwIjoxNzY3MjI0NzAwfQ.J3EHtT1KeCqs6XoHbGMC6cenCD8VW8YPHNKR2ipOlu7z1g5zNsF5M1MINm3ATEplsbNs8cC1Kaw4hbXwn0VfvRqv8jSfOhmG3kW70I9X1GYZjLPIzcvR_cQZ271_KcfcSZujnoHu5EuZBblyNB8MAEQhhfjV_KTfmtz1cDoR2ZpULYWzuqdwyeyI-9Aw_kFk_ueg-E45b1dhkx9mGUSO2cOUa43DZzVtzHqkhwHfxeSTKTxYk3oICaY_329q25cUh4w2ss7ZQQgYIV1fhY5COBQYQ61TuePgHhiGTuBuUkWIfJ0Uw2i3ZzmqrBkpMYURctE1cZ9gLAXUMu0YiZN7_g",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjM4MDAtMTc2NzIyNDcwMCIsImlhdCI6MTc2NzIyMzgwMCwiZXhwIjoxNzY3MjI0NzAwfQ.vRA51HlCDqr-pfDhUKoDIO50zsykGJM-ob1umb5ByYj2uDOLPl800zyu9v5PJrGPDEQMGsxKgsEDTL5vVFKTDMGQyqYVs3JUnrJhVaIV9C8Ua_e1IZqa2V7qa-sKjiXDgLnMW0s-DQGNvoL2QKf1N9kevht-UtdfW7V9OGnSloo2wJyTN1a4j9qslV5l5PK0hXV_IWcI4oQINFhOUvI5Kt7NYUkVuOqotd-TcKNYcjwmI8v-w_2CP6fG86EP07cipUBHadpxjrA6IT8r21UAa8-Oqh5FnUE6-GY1sUZRl49fNDWrY2UDZqdYnOaGSun3cJuX1sLghStSwTXU6Gm0lA",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -75,7 +78,7 @@
       "name": "not-yet-valid",
       "description": "nbf is ten minutes after the evaluation time, beyond any clock tolerance.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwLCJuYmYiOjE3NjcyMjYyMDB9.IrT2Yb6p46ok6yxC33vXiQSz1YlkYr9v4tOuYyOXjaP6VLDojFzp9ePUVSpRJ3KGseYvx5wQqJEC89EVebuBGbPX4prXSFVeiJsUk9ugIX272l3_fPKhvoo8-U0hIOefqy-yE4wtr99pC3o5pVTNkRVBeLf3Dj9qK_qJuUIpkTsyq4lXMQCr5nODmrND5NHFd1RvpSgRIbmUyuS02fWW67v_nrfacRnawKCYkheBoa9Zdq-9yHiW_aeclYhXUDFE35VPTtFIQH9sODWDwGaeHN6PxsqAuaNgKK3S4Oi9W9hN6N9hKf-XctefpSMDmR8qz3NW3ICcDmEy64Zv-kpltw",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwLCJuYmYiOjE3NjcyMjYyMDB9.VqgN6KtelOkvYszNnlXsZmpHVx_TnuiEBt6e9Lqb2YvPiZvZvYZLS8VMXkujQtV9dQK2q3rEOWK7WpzwsW7ejdCQVX6aixsW5W4PdsG0xPUL4NO5_Sw5f9Uk2wNccEb5fTLqm2_3As-PXe59AXtX_o7JLLsZAkqr0lycsaysp9bO53KshB04WDHWpY5jL-fmDuKPurMD3XPMQ4oe-TFvpqAMlOMLeaH3JgdT6Xiv97NtYAfWU_3vzp0O-GLxxTirRlwL9nMkXZ1lj5Bboyp4rOlwu6OBxNEo69LEgMm7Cmify2KpDotPxnqWJXCW6knwROlInIefqnkRAopF1QhkUQ",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -86,7 +89,7 @@
       "name": "wrong-audience",
       "description": "Issued for another product.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImFub3RoZXItcHJvZHVjdCIsInN1YiI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdCIsImp0aSI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdC0xNzY3MjI1NTQwLTE3NjcyMjY0NDAiLCJpYXQiOjE3NjcyMjU1NDAsImV4cCI6MTc2NzIyNjQ0MH0.eeXV-yXckuctyJcs7zMEu--CzOJ5jUBtGIaqZQmF8Q3qAZM9hibaQJB3Ew0gLVTQD1PIFOUM5JIv0OwUJWW7FuaEijhynTpBK037yTe-y5Hvo1btDlvGgQ7QdotS39WqLPdIorI2IndzPSq0j9CiiG9i7TRYaPUaep0dWgM4uBu-p7Tdg4n3hMFeXdaGtd9AzsMoMh-4kJx0W7jKF7YiHEibkCu1-hXmlNdylDiJ-OdaYmhPJu1HDoBs9D0KcLlJyqsvCV4E_3pK3eGLyGwRQ54v5PR5J-kHcXAXoIe-iZlYdPpfX5DxRtOAklHeRyNmNy8csGAcGFgJP7NkQ_VQnw",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImFub3RoZXItcHJvZHVjdCIsInN1YiI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdCIsImp0aSI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdC0xNzY3MjI1NTQwLTE3NjcyMjY0NDAiLCJpYXQiOjE3NjcyMjU1NDAsImV4cCI6MTc2NzIyNjQ0MH0.XXFWK7gQfhV-zF0GhBm3RrgqOeQyQIpVfCXLfle2EERERF5DvLIEg4YZo6YoVR7oo-NfS9AAr4bQOom-WEGY_vrqA678LbS3626K2jE2WiPSvgj1wJnhrDPT0NoSXF05zr5FhhnVbOGF9-SCcv6hSm8K8nyftdLBG8GykqUPhwmiUDlAFJXwcLdI5vIEPKQbZLqijq-JlMngcbPq54CzqkB6xw1Fi1N791zw7uXRkwlzji55Ld6wUHpqU-lk0pLF6iKzM5xkhuCXgTS7KXK0HUaIYIGxzldCzfVNq3SVkj8dRd6UF0v7CnJxGXzNyZm9cAiwwJ1J46Nl3dsn2XnXWA",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -97,7 +100,7 @@
       "name": "wrong-issuer",
       "description": "Signed by the trusted key but naming another issuer.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vaW1wb3N0b3IuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.ZpN1PfxxUKc3dszqk_eciJKkvvwirMRF9SfKKOHH8_bLeq8mS6XpmZDPsq70u3mI0OSw1Cuzmfbr2U78Bi6Kt49VBHVo5M5K3LxmCNJkLhUddB1bpxFP1fBQbBDrqUzLntaDL30HmEWwdLagVhsw-MviWBk7C_viMh1WdgXMv_0-XEYsA76juNjrz4PU5mlpPW8zS9hIuwl7EYNlZa8kB8ok24yfPksZtE1hg8YUVrMi2i2RkgnKG-CW_WBh59sVBlouY4csr8IMHn3zV3kwdHCBAIKeiNh-z3P3asarMRPUDFUwL636ihvXyZRony6jJUjCOegYcvB9dSH6ZEQlMQ",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vaW1wb3N0b3IuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.XJq-_kga-yWW33-wyjYjevshWgeLOgMK2QuHMQncUV5-FGE8qEZZDXpGRYi_qd40EdlzxMdZJLFXqf38Ub6pZZoo9lKmLN-zfwdLZgiujoMgruTdJzkk0JUe6_kbtVbiQIFepm7VfLmnhFeN4o0p9npmXINE3FDDMMXKBrI8APkJA1JX_zOIdamvNRZqMOF_r6lJLr2flIaPM1zAsP45AdUgNY0NHiK4jZqO5rNCMJgvwPDpBuU78zNzW5ZH5iYbdKvG_QE_AVROg9Enxg4cfH2zbrxl377AfqwbqAz1f65AaWgPx5rG_1-OWcoA8FRA2p38-Z4ZBXohlk7vERd26A",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -108,7 +111,7 @@
       "name": "bad-signature",
       "description": "Names the trusted key ID but is signed by another key.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.N6ySuCzMIpFUbnd-Or30sjD_E98oAQFEJlel7thmoyEWhFuiIVmwyU24bKs148r8Ko9sPQ7HKPP7lTO1G0q7IKGEjn5Ds4LkE97T0VAnViYp_5PHZ7BgvYKtFoawJZc5RQKFlXwkSUb50BjFJ_iotnroPsBYzfy_oDVcVoctizQSvCydknDzNBI-R7WTJHdK73XlUyjwJiIxfsgDdNVnm4VagQfJraQcVJGeCIrWzFz_YQZ0mWQOwMLRlwaaWBOCJ_ClaU9qTU0Vhy4AMKW2_0p61u8rN_mtA_qWSEiZYMIVYgDxYvgTO4OwVuUi_un-tA_2k8v_GikXIuyOK6ohDg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.PonwzwBFqrqWQitpXSoAaTbqsRaPS-XfF-QJkIsZG2vRJVkoJaoL6LSqEMvZs0lbGjFfqliLIJgJXsWiheGzz922AQvbsOIAeJbiGuec9yZ5E8qe2NTsdutUMZkSnC1XMhw4n7n1EihjqJXQhTxqwmuFHRKYPjRFfObIX8VMlKw-cEP0DtZZrjWBO1YXaOwg5NgzgQf4z6ZMhfAkAngPHHAcjx50Fwkje79YxfTlXFMwSbcTrBJm4Dfd81mQFpFN3mEUkJyNcGM-Nypk1HGcxSO7hiq7qI7_wohxk05EcW47Lb4sj5hxgnEoxKD2otOo5M5Tv7Ao14YOjLj2Hk-r2w",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -119,7 +122,7 @@
       "name": "unknown-kid",
       "description": "Signed by a key the JWKS does not contain.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLXVua25vd24iLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.PRXTFRE263S0jKbuv9l_As6iEEPFib-_d-mXNeQ5dffjbCCt7JCzT8YZyxzS_IgpNwTB1Te6oDa69TcrgGjTnh7nCUye0_tN64ZoEANPCNgS16LHWaNemW88r-Nzi-2dBtWaSHMpHMFr43B5JcIwsR9jCksguIk8oclt3i1yNIYB1dR_I5YbsWnwy26lNYgo0rlgIbkpkL35VZwejYfuHe3YYozJNbLTvwRUrAbzruNRC_ZoeRnmwAyMaBLx4SVmZSJnxzcuTiy7saArv0vedV34pst4-a9DVvwpeZy_EKHHVFlTnzLVdGVr2ZDly3Fc5uHWDApsfq_LVxuq0vE-DA",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLXVua25vd24iLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.Gc9towTbaDvWaUZ54DPl4Qil36n0ajn0Ql6-uopacIHucHhD5zfQAXHNvwI6BAppRegDWewR1n764TM4W-UESIWxrReLNlEdPi_vSlWOm4ft-z5IzfGX9y-INDEUsRq2L4Ps2lRz4HPQUIW57239c_nl9UOeYHzbrg4jswbRg_Ld2d2Qc5PhUTYKIzsNCeV3UtQQQFbASnfGNEGUe-9OodPwtACmDoMfm_ZqMTZxCWEnwPdH1KeL3i7oGV2rGmRLQj3458RBY6xrGLx1CIQ1iS73jKsxuMxBWtzCOkZOPfsYo4nDAUzdyGwBXNwuP4PjDJy3W8iVyA6_HNuFRr4cPw",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -141,7 +144,7 @@
       "name": "hs256-confusion",
       "description": "HS256, keyed with the trusted public key, to exploit key-type confusion.",
       "principal": "user",
-      "token": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiZm9yZ2VkIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.X3tuRAouszRyCO7IV3TpgE-80FuN1XfsH3bfYRp9r6s",
+      "token": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiZm9yZ2VkIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.khNhRMAyBq4h1BGtn5ElcDfoPkmDMA4eFYTXeR3UMk4",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -152,7 +155,7 @@
       "name": "lifetime-too-long",
       "description": "A one-hour token; Oathweave access tokens live at most fifteen minutes.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyOTE0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI5MTQwfQ.Txf8bZffFR4740gNpE5gb7wNAoQLwC6lrDSN57-ZeqpbdzYykF3-FtkBbRBHsGvOnUysoK7rCkatUki4Yb3YASncBHFYrpQJ10j6BpAZMFevE4GM_b021cWC5vMVLur9foh0j5F4KcvuBPeaFWvGw_NlhVA8oyVV4xkm2MPcUT5e4G8ZvKI2trBDR1RZSgJqv8WgqXUW7_hTCjXs1eazV_rqCJ5WeEaLmynQASVqSwaOIjiIZQC_UWp_0RLkLcEoTFkhKCfYZGrtuCA2yGqPbtoPK_mzzedWv-ww1dP39J4CTA2K4v5w-7kcPNrRO8SvSrVo42FVkD-FwaI-Ybkz5g",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyOTE0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI5MTQwfQ.Bse6FyPkiHXCRdtFFuMKxUpCoSVRp0-WrKTaD3FFo8bKcewHe67hyFKpXHJNulnrtExvDzRD1V0tJKhTQPnyzxGp-GarlwPKIrQuu6aMOOTkSdFdVzgZSCK8yhvL5xZPbtkD8EiX5o7t7aWKZ4XadvAWL0B-FKXTaPCOTIMhNMbi3OX3l0xgiRWZcfPiSLgJQ2ExAzuYYyh-ick6fqY9raLjuDnp4Kms3X2VxYvPzoiV5h8HfPsa_sPJDnlYOx4n1UKWpIyaN1tR0wuKo_1pBGnOLwpN4_yTgbMWo3vLI-99ONmDEQc7iVYyOGjdKWqT0cNPhee0XcpMGfzty4DRmg",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -163,12 +166,53 @@
       "name": "user-without-session",
       "description": "A USER token with no session cannot be revoked and is refused.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwidXNlcm5hbWUiOiJjb25mb3JtYW5jZS11c2VyIiwicm9sZXMiOlsiVklFV0VSIl0sInBlcm1pc3Npb25zIjpbImNvbmZvcm1hbmNlOnJlYWQiXSwic2NvcGUiOiJvcGVuaWQgY29uZm9ybWFuY2U6cmVhZCIsImF1dGhfdGltZSI6MTc2NzIyNTQ4MCwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.Gy_tAGnksWVv8bf_k4hRoA1bSr_3r6Q6wdEa-q-4ZQAGX5L10O-o_uZHhW-DFjS7Z9LDWNarrHH04MW1kkC2DUX5hylt-JX72vHJXHDJH4XedJC8yZ5y2yDz2qgss68iSx-4y4cmTddI1Vzra3lJ7F_W9BG9znvGP-u8IfxXxu1iIBjt7oNnPbYw2xQOETFst7_exu0XbfY8t1F86x5N2a5iyOSO4_ocvj6wwXwGSKBlnLZ9he12CiRraIpOrUkJlzW3Sia_KCsBBwrrBIHDBm6WJRl8SlfbLScQJlJxA5n6riGtjPqmN44d0H2z_rj8RsyHB15ocNMUsUGapiIUHA",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwidXNlcm5hbWUiOiJjb25mb3JtYW5jZS11c2VyIiwicm9sZXMiOlsiVklFV0VSIl0sInBlcm1pc3Npb25zIjpbImNvbmZvcm1hbmNlOnJlYWQiXSwic2NvcGUiOiJvcGVuaWQgY29uZm9ybWFuY2U6cmVhZCIsImF1dGhfdGltZSI6MTc2NzIyNTQ4MCwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.QoN7my4VGDehZNulCrZCXdq4d01trKuSzKYofoZdzsDOlP5tjCHPxlnKVDmvIh6NXahlV3Yxauj4w6_Q_7WPytXTvJqAHF7VlqZihvMk7Qt0YPD12vjkMHC7yJSRqOiCilvAhH2nzYV6gwbHUCx_dXLhsrH3X5mWFinllLj_yrvqR7n0IXLB8oUzBNii6tcDwVXSsAtyIm0pd876XjvSfOQcAZ2kHznUtRgIybX_w3kWTnfGAEdF6qE9ksWY6RNr063pv__5UFfXDOQdMaqxpO6TA6Vonoq0e0X0vW8DIWKyxAt_rZCE1ju_pX2wP29Lt5Ja6wMRTZWs6K2yRoy8-A",
       "expect": {
         "outcome": "reject",
         "status": 401,
         "reason": "invalid_claims"
       }
+    },
+    {
+      "name": "valid-native-service",
+      "description": "A client-credentials token signed with the configured native issuer and the same keys.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiY29uZm9ybWFuY2UtaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.tzDv8M9EYauZzS1hVvgoW5miWyRdnlatpGh6QfIxvxn2b8qG90FMQmLdPZffcXiD5T4gAq0JGO_LGiaPeY8rp7Jq_mz4RZXIAvVvQ_2hjC_o7nh8mu6KWtbqAfK1UB6ZerMo3w_9T6Dcll1-irNzlSTGvjItY1dJJHMvq-y_rKY5c_GpWOEy6BIkqAZXbl5D2If_zZIJgonJ0S65fVbG-rHUxHzlL7G4UrDO6KplCqVJbU_wBhmS7Tcgrpb2RX_tUGXZkr1B5xkSnJ-gAlm5-1YEOw9V64wK94fRn6V2hdHP6xp3fQs444GRpnhl9YytlW5bwzV9Il7h5lGvoW_Tgg",
+      "expect": {
+        "outcome": "accept",
+        "kind": "service",
+        "subject": "conformance-service",
+        "clientId": "conformance-service",
+        "roles": [],
+        "permissions": [
+          "conformance:write"
+        ],
+        "scopes": [
+          "conformance:write"
+        ]
+      }
+    },
+    {
+      "name": "unconfigured-native-issuer",
+      "description": "A client-credentials token from a native issuer that is not configured.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaW1wb3N0b3ItaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.au69pXP0GSRHLRlcE3mF3_pquzd7OK2_2xkfZNJPmvBzdkgDG2-xTk3oInpgYdEqBS2gHyi9P2ZbkEM3UhhD0sgDNudQYZQsYSzaptX17oQYEJAk_3fnPL9WMUlmEqt0ifpOaXmIkSq-gPu9G3GXP1VMtZPpueuMBRshQQncj7bs5amNTck-48MaR8IY7LY95ghzkczgVOdO783lqjPu0u1tvYKwLe7MP8I8DxKzYwEhn7aHYlL_f6a1i6QAmrq_D55_M39CEff-AZC6koqo7SlaeQcJpj6dJSpZIDwbbHUdlzCmpzwWDLlEqnJOEoRdw_teSP0223Xd-LwNkJfSnw",
+      "expect": {
+        "outcome": "reject",
+        "status": 401,
+        "reason": "invalid_issuer"
+      }
+    },
+    {
+      "name": "native-service-lifetime-too-long",
+      "description": "A one-hour client-credentials token from the native issuer.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiY29uZm9ybWFuY2UtaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjkxNzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyOTE3MH0.d0o46Nuw0c29NsGRaeCrdaIN2tUoUX5tLech0f1sIwMw3qxGYPWIyVkhrefmGOWkOW2gP3HMF7UhNiUo26suDSnIRB5qwlZQ48rqA4ymRYWbeT_cfArXU_F-7tUOTgnaMSe8r6TqbvaGfQjJciuv_NULkta_Q7mrFz6hYHxu2beDoFP1xrlBOIqUxzYpBznAUro08cjIumN-kMP29D_v3MaQac0ea4_C1ZBtdUd-VISe756pIv9qygtTal3QG3nU00OrKTKNEgNNmmjMmX6C3On5rSD4LFZhsFXfkvIBS6KJWHSHs2fLTC9V2m0EIJI5oHtOYYN6ij4YEaVE9Vi1gw",
+      "expect": {
+        "outcome": "reject",
+        "status": 401,
+        "reason": "invalid_lifetime"
+      }
     }
   ]
 }